×

Set Up HubSpot Email Authentication

/ CRM, Hubspot / By

How to Configure Email Authentication in HubSpot

Correctly configuring email authentication in HubSpot is essential for improving deliverability, protecting your sender reputation, and making sure your marketing messages reach your contacts instead of the spam folder.

This guide walks you through the full process of setting up DKIM, SPF, and DMARC with your domain so that email providers can verify that messages sent from your HubSpot account are legitimate.

What Is Email Authentication in HubSpot?

Email authentication is a set of DNS records that proves your marketing emails are authorized to be sent from your domain. In HubSpot, authentication focuses primarily on:

  • DKIM (DomainKeys Identified Mail) – signs outgoing messages so inbox providers can verify they were not altered.
  • SPF (Sender Policy Framework) – tells receiving servers which services are allowed to send mail for your domain.
  • DMARC (Domain-based Message Authentication, Reporting & Conformance) – defines what should happen when DKIM or SPF checks fail.

When DKIM, SPF, and DMARC records are configured correctly, providers like Gmail and Outlook are more likely to trust campaigns sent from your HubSpot tools.

Before You Start: Requirements for HubSpot Email Setup

To set up authentication, you need access to a few key items outside of your HubSpot portal.

Check Your HubSpot Subscription

Any HubSpot account that sends marketing email should configure authentication, including Marketing Hub Professional and Enterprise subscriptions. The process is managed from your email settings, but changes must be completed in your DNS provider.

Confirm Access to Your DNS Host

You must be able to add or edit DNS records for the sending domain you want to use. Common DNS providers include:

  • GoDaddy
  • Cloudflare
  • Namecheap
  • Domain.com
  • Hosting dashboards such as cPanel or Plesk

If someone else manages DNS for your organization, coordinate with them before starting the configuration in HubSpot.

Step 1: Connect Your Email Sending Domain in HubSpot

The first step is to connect the domain that appears in the From address of your marketing emails.

  1. Log in to your HubSpot account with super admin or email settings permissions.

  2. Navigate to your email settings (Marketing > Email > Configuration, or the equivalent area in your portal).

  3. Find the section for email sending domains and choose the option to Connect or Add a new domain.

  4. Enter the domain that matches your From address, such as example.com. Avoid using free mailbox domains like Gmail or Yahoo; use a branded domain controlled by your organization.

  5. Confirm to generate the DNS records that HubSpot will provide for DKIM and related settings.

After this step, HubSpot will display a list of records that must be added to your DNS provider to complete authentication.

Step 2: Add DKIM Records from HubSpot to Your DNS

DKIM is the core authentication method HubSpot uses to sign outgoing messages from your domain.

Locate Your HubSpot DKIM Values

In your connected domain settings, you will see two CNAME records generated for DKIM. Each record contains:

  • Host or Name – the subdomain portion that you add to DNS, often something like hs1._domainkey.
  • Value or Points to – a long string that points to a HubSpot-specific domain.

Leave this settings screen open while you work in your DNS provider so you can copy the values accurately.

Add DKIM CNAME Records in Your DNS Provider

To add the DKIM records supplied by HubSpot:

  1. Open your DNS host’s dashboard and locate the DNS management area for the same domain you connected in HubSpot.

  2. Choose to add a new CNAME record.

  3. In the Name or Host field, paste the value shown in your HubSpot domain settings.

  4. In the Target or Points to field, paste the full CNAME value from HubSpot.

  5. Repeat for the second DKIM CNAME record.

  6. Save or apply your DNS changes.

DNS propagation can take several minutes to several hours depending on your provider. Do not delete any existing records for other services unless your IT or DNS administrator confirms it is safe to do so.

Step 3: Verify DKIM Records Inside HubSpot

Once the DKIM records have been added to DNS, return to your HubSpot email domain configuration panel.

  1. Open the sending domain you have been configuring.

  2. Click the option to Verify or Check DNS for the domain.

  3. HubSpot will query your DNS provider to see if the CNAME records are live and correctly configured.

  4. If verification succeeds, the domain status will update to show as authenticated or verified for email sending.

If verification fails, wait a bit longer for DNS propagation and confirm that the host, value, and record type exactly match the instructions in your HubSpot panel. Be especially careful with trailing dots, extra spaces, or partial values.

Step 4: Align SPF and DMARC with HubSpot Sending

While HubSpot primarily relies on DKIM, SPF and DMARC also affect how inbox providers treat your messages.

Review Your Existing SPF Record

Your domain should have only one SPF TXT record. If one already exists, you usually need to modify it rather than add a second record. In most cases, HubSpot is already covered by its shared sending infrastructure, but your DNS administrator should confirm the correct SPF value according to your organization’s policies.

General guidelines:

  • Keep only a single SPF record per domain.
  • Ensure all valid sending services (such as your CRM, help desk, or other mail providers) are included.
  • Avoid duplicate or conflicting SPF entries.

Ensure DMARC Policy Works with HubSpot

If your organization uses DMARC, the policy must not block authenticated messages sent from HubSpot. Common configurations:

  • p=none – monitoring only.
  • p=quarantine – suspicious messages go to spam.
  • p=reject – suspicious messages are refused.

Work with your IT or security team to make sure DKIM alignment and SPF alignment are correctly configured so that DMARC does not treat legitimate HubSpot campaigns as unauthorized.

Troubleshooting HubSpot Email Authentication Issues

If DNS verification or email sending fails, there are several common causes you can review before escalating to your administrator or to support.

Common DKIM Problems

  • The CNAME host names were entered without the correct subdomain.
  • The CNAME values were truncated or pasted with extra spaces.
  • Additional security tools at your DNS provider are rewriting or filtering CNAME records.
  • Not enough time has passed for global DNS propagation.

SPF and DMARC Conflicts with HubSpot

  • Multiple SPF records exist for the same domain, causing validation errors.
  • The DMARC policy is set to reject without proper alignment for HubSpot’s authenticated mail.
  • Another service is altering the From address or Return-Path, causing alignment failures.

In each case, compare your DNS settings to the instructions provided in your HubSpot email authentication panel and coordinate changes with your IT team when needed.

Best Practices for Ongoing HubSpot Email Deliverability

Authentication is only one part of maintaining strong deliverability with your marketing email tools.

  • Send from a consistent branded domain that matches your website.
  • Avoid frequent changes to your From address configuration inside HubSpot.
  • Regularly clean invalid or disengaged contacts from your lists.
  • Monitor open, click, bounce, and spam complaint rates to spot issues early.
  • Follow permission-based email practices and honor unsubscribe requests immediately.

Combining a clean list, valuable content, and solid technical configuration keeps your mailbox reputation strong across major providers.

Where to Learn More About HubSpot Email Configuration

For detailed, product-specific steps, screenshots, and the latest platform updates, consult the official documentation on how to manage email authentication in the HubSpot knowledge base. You can review the original instructions at this HubSpot email authentication guide.

If you need strategic help implementing technical best practices, aligning marketing operations, and improving deliverability alongside your broader CRM and automation setup, you can also work with a specialized partner such as Consultevo.

Once your DNS records are verified and your domain is authenticated, your HubSpot account will be better positioned to send trusted, high-performing campaigns that consistently reach the inbox.

Need Help With Hubspot?

If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.

Scale Hubspot

“`